Data Processing Addendum

This addendum forms part of the Terms of Subscription between you and Green Rajasthan Private Limited (Comriq). Where the two differ on personal data, this addendum governs.

1. Roles

You are the data fiduciary under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, for the personal data you or your users put into the products. Comriq is your data processor and processes that data only on your documented instructions: the agreement, your configuration of the products, and your written requests.

2. What is processed, and why

Comriq does not use this data for its own purposes, does not sell it, and does not use it to train models or to advertise.

3. Comriq's commitments

• Process only on your instructions, and tell you if an instruction appears to break the law.
• Make sure everyone with access is bound by confidentiality, and limit access to what each task needs. Support access is read-only, time-limited and recorded in your audit log.
• Apply reasonable security safeguards: encryption in transit and at rest, per-organisation separation by row-level security, per-organisation keys for identity documents, signed short-lived links, virus scanning of uploads, daily backups in India, and an audit trail that cannot be switched off.
• Help you respond to requests from the people whose data you hold (access, correction, erasure, nomination, grievances), through the product's export and correction tools and by email.
• Keep the records of consent the products collect for features that need it (for example location, biometrics, Focus and children's data), with the notice version.

4. Sub-processors

Comriq uses the sub-processors listed in the Privacy Policy: Supabase (database and storage, Mumbai), Vercel (hosting), Postmark (email, United States), Microsoft 365 (Comriq's mailboxes), and Razorpay and Stripe for payments. We give you at least 30 days' notice before adding or replacing a sub-processor that handles your data, and you may object; if we cannot resolve the objection, you may end the affected product with a pro-rata refund. Each sub-processor is bound by written terms that protect the data at least as well as this addendum.

5. Where the data is

Your product data and documents are stored in Mumbai. Outbound email passes through Postmark in the United States. We will not move stored product data outside India without telling you first, and never to a country the Government of India restricts.

6. Personal data breach

If Comriq becomes aware of a personal data breach affecting your data, we tell you without delay, and in any case within 24 hours of confirming it, with what we know: what happened, the data and people affected, what we have done and what you may need to do. This gives you time to inform the Data Protection Board and the people affected as the DPDP Rules require. We keep a record of every breach.

7. End of the subscription

You can export all your data during the subscription and for 30 days after it ends. After that, Comriq deletes it from live systems within 30 days and from backups within the following 90 days, unless the law requires us to keep part of it, and issues a deletion certificate on request.

8. Audits

Once a year, or after a breach, you may ask for information to show that Comriq meets this addendum. We answer with documents and written replies; an on-site audit by an independent auditor bound by confidentiality can be agreed in writing, at your cost, with reasonable notice.

9. Children

For Campus, you obtain verifiable consent from a parent or lawful guardian before a child's data is processed, for each purpose, and record its withdrawal. Comriq does not track children beyond what education and safety need, shares bus location only during the ride, and does not profile children or direct advertising at them.

10. Contact

Data protection questions: privacy@comriq.com. Grievances: grievance@comriq.com.